[tbb-dev] How does Tor Browser treat locally-installed CA cert?

Hi,

As part of working on the CT Gossip draft [0] I find myself thinking about local trust anchors and how they might change browser behaviours.

My understanding is that Tor Browser behaves like Firefox wrt locally added CA certs. If that's correct, do you know if FF treats pinning the way the "What Is HPKP For?" post [1] describes it?

Another question that I find interesting is if TB could do better regarding fingerprintability based on what TLS session the browser accepts.

[0] https://datatracker.ietf.org/doc/draft-ietf-trans-gossip/ [1] https://noncombatant.org/2015/11/24/what-is-hpkp-for/